API authentication is separate from UI/SSO authentication

The public API and MCP server authenticate independently via a bearer-token model — tokens are generated per environment from Admin → Generate Token, are bound to a single environment, and are not gated behind the SSO flow. Programmatic access and interactive access are two separate authentication paths by design.